Claude Code VS Code Extension Compromised for SSH Backdoor

Introduction

Cybersecurity researchers have disclosed a significant supply chain compromise involving the official Anthropic Claude Code extension for Visual Studio Code. The extension, published on the Open VSX registry, was found to contain a persistent SSH backdoor capable of maintaining long-term access on infected hosts. This incident underscores the growing risk of attacks targeting developer tooling and AI-powered coding platforms.

Attack Vector and Initial Compromise

The malicious activity was first observed when researchers noticed anomalous behavior in the Claude Code extension distributed through Open VSX, an open-source alternative to Microsoft's VS Code marketplace. The compromised extension was modified to silently install a persistent SSH backdoor on any system where it was executed. This backdoor allowed remote attackers to maintain access to compromised machines, potentially leading to data exfiltration, lateral movement, or further exploitation within affected networks.

Cursor Marketplace Implicated

The investigation later traced the root cause of the compromise to the Cursor Marketplace, the platform used by the AI coding assistant Cursor to distribute extensions and plugins. Cursor, a popular AI-powered code editor, temporarily took down its marketplace service in response to the discovery of the malware. The company confirmed it had identified a security incident and acted swiftly to remove the malicious code from its infrastructure. While the exact method of compromise remains under investigation, the incident highlights the interconnected nature of modern development ecosystems and how a single breach can cascade across multiple platforms.

Impact on Developers and Organizations

Developers and organizations using the Claude Code extension via Open VSX or Cursor are advised to audit their systems for signs of compromise. The SSH backdoor could have been active on affected machines for an unknown period, during which time attackers may have gained persistent access. Given the privileged nature of development environments and the sensitive credentials often stored within them, the potential impact is severe. Organizations should assume that any systems where the extension was recently installed may be compromised and take appropriate remediation steps.

What Defenders Should Do Now

Security teams should immediately review logs for unauthorized SSH connections originating from development machines. Any systems where the Claude Code extension was installed should be isolated and scanned for Indicators of Compromise (IOCs). Developers should uninstall the affected extension and reinstall it from a trusted source once the issue is resolved. Additionally, organizations should enforce strict extension verification policies, monitor for unusual network activity, and consider implementing application allowlisting to prevent unauthorized code execution. Rotating SSH keys and credentials stored on potentially affected machines is also strongly recommended.

Conclusion

The compromise of the Claude Code extension serves as a stark reminder of the vulnerabilities inherent in modern software supply chains, particularly those involving AI-powered development tools. As the ecosystem continues to evolve, so too must the security practices that protect it. Organizations seeking to strengthen their defenses against similar threats can benefit from Grivyonx's AI automation and cloud security services, which provide intelligent monitoring and automated response capabilities tailored to complex development environments.